Exeora

Secure execution for AI agents,
on any machine

Exeora is an open-source service for securely connecting AI coding agents and MCP clients such as Claude, ChatGPT or Cursor to development projects on machines you control. It uses one outbound connection: no inbound port, no source-code upload and no tunnel.

Google Sign-In is optional. Exeora uses only your verified email address, name and profile photo to authenticate you and connect you to the correct Exeora account. It does not request access to Gmail, Drive, Calendar, contacts or other Google services, and it never stores Google access or refresh tokens. Read the privacy policy.

Get started Star onGitHub

curl -fsSL https://exeora.dev/macos/install.sh | sh

exeora connect

Native Rust CLI. Install once, then run it in the directory you want to serve.

Speaks MCP, so it works with

Claude
ChatGPT
Cursor
VS Code
Copilot
Devin
Antigravity
Amp
Zed
Grok
Perplexity
OpenCode

Anything that speaks Streamable HTTP and OAuth 2.1 can connect - no plugin on the client side

How it works

Three facts that explain the whole design

No inbound network path, no copy of your code, and a blast radius you decide when you authorize a client

1
The CLI dials out. Nothing dials in
The machine opens an outbound WebSocket and holds it. No inbound port, no tunnel, no VPN - the same command works behind NAT and behind a corporate firewall
2
Your code never leaves the machine
Exeora routes tool calls; it does not store your repository. Files are read, searched and edited where they already are, and only the result of a call crosses the wire
3
You choose the blast radius
A project's own URL reaches that project and nothing else, because the project is in the path rather than in anything the client sends. One account URL covers several, and you tick which ones when you authorize it

Compare

Neither a tunnel nor a sandbox

A tunnel exposes a port you then have to defend. A sandbox gives an agent a copy of your project rather than the project

Where your code lives

Exeora: The machine you ran it on
ngrok, Cloudflare Tunnel: The machine you ran it on
Cloud sandbox: A copy on their infrastructure

Inbound port

Exeora: None
ngrok, Cloudflare Tunnel: None, but the tunnel publishes a public URL
Cloud sandbox: None

What is reachable

Exeora: Ten tools, one project directory
ngrok, Cloudflare Tunnel: Whatever is listening on that port
Cloud sandbox: A full shell in the copy

Per-project isolation

Exeora: A separate OAuth resource and token
ngrok, Cloudflare Tunnel: You build it
Cloud sandbox: One sandbox per project

Authentication

Exeora: OAuth 2.1, built in
ngrok, Cloudflare Tunnel: Whatever your service does, often nothing
Cloud sandbox: The vendor's account

Your real toolchain and state

Exeora: Yes
ngrok, Cloudflare Tunnel: Yes
Cloud sandbox: Reinstalled, and never quite the same

Setup

Exeora: Install, log in, add a project
ngrok, Cloudflare Tunnel: Run the tunnel, then secure it yourself
Cloud sandbox: Push your code

Source

Exeora: Open source (AGPL-3.0) - audit every line
ngrok, Cloudflare Tunnel: Varies by tool
Cloud sandbox: Usually closed

	Exeora	ngrok, Cloudflare Tunnel	Cloud sandbox
Where your code lives	The machine you ran it on	The machine you ran it on	A copy on their infrastructure
Inbound port	None	None, but the tunnel publishes a public URL	None
What is reachable	Ten tools, one project directory	Whatever is listening on that port	A full shell in the copy
Per-project isolation	A separate OAuth resource and token	You build it	One sandbox per project
Authentication	OAuth 2.1, built in	Whatever your service does, often nothing	The vendor's account
Your real toolchain and state	Yes	Yes	Reinstalled, and never quite the same
Setup	Install, log in, add a project	Run the tunnel, then secure it yourself	Push your code
Source	Open source (AGPL-3.0) - audit every line	Varies by tool	Usually closed

Guarantees

Built so the dangerous parts are small

One outbound connection, one resource per project, rules you can tighten, and a log that records what happened without recording what was in it

No inbound path

Nothing listens on the machine. The CLI opens an outbound connection and holds it, so home routers, corporate proxies and cloud VMs with no public address all work unconfigured

Your code never leaves

Exeora routes tool calls; it does not store the repository. Files are read, searched and edited where they already are, and only the result of a call crosses the wire

Blast radius you choose

Every URL is its own OAuth resource, so a token for one project is refused at another. Paths are resolved through realpath before anything touches disk - `..` and outward symlinks are rejected

Policy you can tighten

Read only, allow list, deny list, per-tool restrictions, and optional approval before edits and commands. Shell metacharacters are refused whenever a list is in force

Audit without leaking

Which tool ran, how it ended, how long it took, and which client asked. Never the arguments, never the output - a log you can show someone

Revoke and it stops

Closing a machine kills the live socket that instant, not when a token expires. The whole stack is open source under AGPL-3.0 - audit it, fork it, contribute

Ten tools, one project directory - full tool reference

What you are agreeing to

An agent you connect can run anything inside that project

A new project allows everything until you narrow it. From the dashboard you can set it to read only, name the commands it may run, refuse specific ones in any mode, choose which tools exist, and ask to confirm every change before it happens. Paths stay confined to the project root either way, but that confinement is not a sandbox: a command that runs still runs as you, with your environment and your network.

An allow list with shell turned on is only a suggestion. Confirmation only reaches a person who is there: in the conversation on MCP 2026-07-28, and otherwise on the machine's terminal or in the dashboard. Revoking a machine from the dashboard closes its connection immediately, so that is the stop button.

The full model is in what a project allows. The source is public on GitHub, so you can audit every line.

FAQ

The questions worth asking first

Mostly about what Exeora can see, what it cannot stop, and how to make it stop

Can you see my code?

No. The gateway routes tool calls and returns their results; it never receives a copy of your repository. What does cross the wire is whatever a tool returns, for example the lines a grep matched, and none of that is stored. The audit log records the tool name, the outcome and the duration, never arguments or output.

What happens when the machine goes away?

The connection drops and calls to that project fail immediately with LOCAL_EXECUTOR_OFFLINE. Nothing is queued, by design: every call also carries an absolute deadline that the CLI rechecks on arrival, so a command asked for hours ago cannot run when the machine wakes up.

Can I limit which commands run?

Yes. From the dashboard you can set a project to read only, name the commands it may run, refuse specific ones in any mode, choose which tools exist, and ask to confirm every change before it happens. A project may also carry an exeora.toml that can only narrow those rules, never widen them. See what a project allows.

Does this work behind a corporate firewall?

If the machine can make outbound HTTPS requests, yes. The CLI opens the connection outward and keeps it, so there is no inbound rule to request, no port to forward and no VPN to join.

How do I revoke access?

Revoke the machine from the dashboard. That closes its live socket at once and stops it serving anything, rather than waiting for a token to expire. Removing a project takes its MCP URL out of service the same way.

Is Exeora open source?

Yes. The full stack - CLI, gateway, dashboard and docs - is public on GitHub under the AGPL-3.0. You can read every line, audit the security model, open issues and send pull requests. The hosted product at exeora.dev runs that same code.

Point an agent at a machine

One command, one browser sign-in, and a URL you paste into whichever client you already use. Run it wherever the work is. Open source under AGPL-3.0 - every line is on GitHub.